20256b3e9ddc4c32b80cd32176cb0115c7f98df7f166c6072da7d52d8ee2d704

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_5de4639844d1e325a0a8ff40c036dcdd_elex_wannacry.exe
Size 16KB
Sample260821-e5s34asgrc
SHA256 20256b3e9ddc4c32b80cd32176cb0115c7f98df7f166c6072da7d52d8ee2d704
MD5 5de4639844d1e325a0a8ff40c036dcdd
SHA1 924ebdb3cc84df0317e978cd3cf4b5163f2e65f5
SHA512 bededa6c8eba7543e9562bed4da35a3ffcf5e950d8035d6b05c78a6b8e01b1bd86ba6dfbcd5261372d623a5dc698d58cc1353c5645c2c80a4bfb10d55f087bfb
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFDo2SR:1NIlcanKw9hBe
TLSH
T15272A3396FD60EB2D373C5B289F7A2D69932B823BE030A1EC45C17059C03A53AD91D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-21_5de4639844d1e325a0a8ff40c036dcdd_elex_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3484	ieupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_5de4639844d1e325a0a8ff40c036dcdd_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieupdater.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3484	2468	2026-08-21_5de4639844d1e325a0a8ff40c036dcdd_elex_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-21_5de4639844d1e325a0a8ff40c036dcdd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_5de4639844d1e325a0a8ff40c036dcdd_elex_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ieupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\ieupdater.exe
Size 17KB
SHA256 952781613add1c71d4b3f873b3525f3af6474eafb8f1d0bf07b3e2cb57d05ab5
MD5 66793ce709a1b3401b7402dc00810edf
SHA1 ef5458011bb09bc4e8b4195c935604bd5481011a
SHA512 b24cf449ff8f039b5ae48f00a7fa8acaeb0f07b347b9172f8b2be65cb6c3921fa199d4164091943b94bf2c8e65d001b9e81813e59e76028b089c25e9b7d9089e
SSDEEP 384:1NIzB/LB6fil1FRbNz7AJ9o9jggFDo2S/:1NIlcanKw9hBM
TLSH
T14772A4396FD60EB2D373C5B289F7A2D69932B823BE031A1EC45C17059C03A53AD91D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download